Tencent/WeKnora · error

knowledge base %s is not within the current Agent scope

Error message

knowledge base %s is not within the current Agent scope

What it means

Scope authorization rejection: the document exists, but its owning knowledge base ID is not contained in the server-owned search targets for this Agent execution, so the KB-level containment check fails and access is denied to prevent cross-tenant/cross-KB data leaks.

Source

Thrown at internal/agent/tools/scope_authorization.go:80

	knowledgeID string,
	knowledgeService interfaces.KnowledgeService,
) (*types.Knowledge, error) {
	knowledgeID = strings.TrimSpace(knowledgeID)
	if knowledgeID == "" {
		return nil, fmt.Errorf("knowledge_id is required")
	}
	if knowledgeService == nil {
		return nil, fmt.Errorf("knowledge service is unavailable")
	}
	knowledge, err := knowledgeService.GetKnowledgeByIDOnly(ctx, knowledgeID)
	if err != nil || knowledge == nil {
		if err == nil {
			err = fmt.Errorf("empty result")
		}
		return nil, fmt.Errorf("document %s not found: %w", knowledgeID, err)
	}
	if !searchTargets.ContainsKB(knowledge.KnowledgeBaseID) {
		return nil, fmt.Errorf("knowledge base %s is not within the current Agent scope", knowledge.KnowledgeBaseID)
	}
	allowed, err := searchTargetsAllowKnowledgeID(
		ctx, searchTargets, knowledge.ID, knowledge.KnowledgeBaseID, knowledgeService,
	)
	if err != nil {
		return nil, fmt.Errorf("failed to validate document scope: %w", err)
	}
	if !allowed {
		return nil, fmt.Errorf("document %s is not within the current @mention scope", knowledge.ID)
	}
	return knowledge, nil
}

// authorizeChunkInSearchTargets is the chunk/FAQ counterpart of
// authorizeKnowledgeInSearchTargets. A chunk ID is accepted only after the
// server resolves its owning document and validates that document against the
// full KB/document/tag scope.
func authorizeChunkInSearchTargets(

View on GitHub (pinned to 988cbb0330)

Solutions

1. Add the knowledge base to the Agent's search targets
2. Verify the correct Agent/session scope was passed
3. Do not widen scope client-side; fix the binding configuration instead

When it happens

Trigger: Thrown at internal/agent/tools/scope_authorization.go:80 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Tencent/WeKnora@988cbb0330 (2026-09-02). Data as JSON: /api/errors/b0f0a7d34cfc4ce8. Report an issue: GitHub.